Vela Exchange — TEE Verification

Trusted hardware.

Verified execution.

In addition to ZK proofs, Vela is building hardware-based attestation using AMD SEV-SNP Trusted Execution Environments. The TEE hardware itself proves that the correct matching engine binary ran on tamper-proof infrastructure — without trusting the operator.

Two Verification Paths

Complementary, not competing.

ZK Proofs (VEL-T1-01)

Trustless cryptography

The matching engine computed the correct output — mathematically, without trusting any hardware or operator.

Trust model: No hardware trust required. Pure math.

Status: Infra built. SP1 integration: June 2026

✓ Trustless — no hardware dependency

✓ Publicly verifiable by anyone

✗ Computationally expensive to generate

✗ Requires ZK-compatible circuit design

TEE Attestation (VEL-T1-04)

Hardware trust

The correct binary ran on tamper-proof AMD SEV-SNP hardware. The hardware itself guarantees no modification occurred.

Trust model: Requires trusting AMD/Intel hardware. Stronger operational trust than software alone.

Status: Infra built. AMD SEV-SNP deployment: June 2026

✓ Fast — attestation in milliseconds

✓ Available on standard cloud VMs today

✓ Binary hash proves which code ran

✗ Requires trusting hardware manufacturer (AMD/Intel)

Architecture

AMD SEV-SNP + Vela.

Confidential VM

The Vela matching engine runs inside an AMD SEV-SNP Confidential Virtual Machine. The hardware encrypts all memory and protects execution from the hypervisor, cloud provider, and operator.

Measurement

At startup, the AMD hardware measures the exact binary that loaded into the TEE. This measurement is a cryptographic hash of the matching engine code — anyone can verify it matches the published open-source binary.

Attestation report

After each batch of trades, the TEE hardware generates an attestation report signed by the AMD VCEK key. This report includes the measurement, the state root, and a timestamp — proving the correct code processed the correct data.

On-chain publication

The attestation report is published alongside each state root anchor on Ethereum. Anyone can verify the AMD certificate chain and confirm the report is genuine.

Current Status

DEVELOPMENT MODE

TEE hardware deployment requires AMD SEV-SNP confidential VMs on Azure, AWS, or GCP. Current deployment (fly.io) uses standard VMs without TEE hardware.

Loading binary hash…

● NOW — Placeholder attestation (binary hash computed)

○ JUNE 2026 — AMD SEV-SNP deployment on Azure Confidential VMs

○ POST-MAINNET — NVIDIA H100 GPU attestation for ZK acceleration

○ FUTURE — Intel TDX support via ROFL framework

Attestation History

Loading attestations…

← ZK Proof System Batch Explorer →